# CVE-2021-37712: npm tar arbitrary file creation via directory cache poisoning

Source: https://junglewise.ai/threats/cve-2021-37712-npm-tar-arbitrary-file-creation-via-directory-cache-poisoning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-08-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-37712 · Severity: low · CVSS 3.1 · Published 2021-08-31

npm's tar package is used to extract compressed tar archives in Node.js applications. A flaw in its symlink protection allows a specially crafted tar file to bypass security checks and create or overwrite arbitrary files on the system. An attacker can exploit this by providing a malicious tar archive, potentially leading to code execution or data compromise.

Technologies: [tar (npm)](https://junglewise.ai/threats/technologies/npm-tar). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-37712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-37712 being exploited in the wild.

**How severe is CVE-2021-37712?** Low severity, with a CVSS score of 3.1, published 31 August 2021.

**Which products and versions are affected?** tar (npm) SEMVER:introduced=3.0.0,fixed=4.4.18.

**Is there a fix for CVE-2021-37712?** Yes. tar (npm): upgrade to 4.4.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-37712 attacked?** It is attacked with local access.

**Am I affected by CVE-2021-37712?** Check whether you run tar (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tar (npm): upgrade to 4.4.18 or later

  ```sh
  npm install tar@4.4.18
  ```


## Technical details

The vulnerability is a path traversal issue (CWE-22, CWE-59) in the directory cache and path reservation logic of node-tar. The root cause is insufficient normalization when caching directory paths: the library failed to normalize unicode characters and Windows 8.3 short paths correctly. An attacker can craft a tar archive containing two directories with names that normalize to the same path (via unicode normalization or 8.3 short names), followed by a symlink using the first form and a file using the second form. This poisons the directory cache, causing the symlink check to be bypassed and allowing extraction to an arbitrary location. No authentication is required; exploitation occurs during tar extraction of untrusted archives. The vulnerability has been fixed in versions 4.4.18, 5.0.10, and 6.1.9 via proper unicode normalization using String.normalize('NFKD') and clearing the directory cache when symlinks are encountered on Windows.

## Affected products

- npm tar 3.0.0 through 4.4.17, 5.0.0 through 5.0.9, 6.0.0 through 6.1.8

## Identifiers

- CVE-2021-37712
- GHSA-qq89-hq3f-393p

## Timeline

- 2021-08-31: disclosed
- 2021-08-31: patched: versions 4.4.18, 5.0.10, 6.1.9 released

## References

- [https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p](https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p)

## Related threats

- [npm tar stack overflow in mapHas filter with long paths](https://junglewise.ai/threats/cve-2026-73566-npm-tar-stack-overflow-in-maphas-filter-with-long-paths)
- [node-tar denial of service via NUL byte in PAX records](https://junglewise.ai/threats/cve-2026-59875-node-tar-denial-of-service-via-nul-byte-in-pax-records)
- [isaacs node-tar infinite loop in tar.replace](https://junglewise.ai/threats/cve-2026-59874-isaacs-node-tar-infinite-loop-in-tar-replace)
- [isaacs node-tar Denial of Service via Gzip Bomb](https://junglewise.ai/threats/cve-2026-59873-isaacs-node-tar-denial-of-service-via-gzip-bomb)
- [isaacs node-tar denial of service via PAX numeric path type confusion](https://junglewise.ai/threats/cve-2026-59871-isaacs-node-tar-denial-of-service-via-pax-numeric-path-type)